MS-102 Practice Test 10 — 10 Questions

Question 1

You are a compliance administrator for Contoso Ltd. The company uses Microsoft Purview Information Protection with sensitivity labels. A new regulation requires that all documents labeled 'Highly Confidential' must be encrypted and only accessible by members of the 'Legal' group, even when shared externally. You have published a label named 'Highly Confidential' with encryption settings. You need to ensure that the label enforces these requirements when applied to documents in Office apps. What should you configure in the label's encryption settings?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign permissions to the 'Legal' group with 'Viewer' role, and clear the option 'Let users assign permissions'.. To enforce that only the Legal group can access documents labeled 'Highly Confidential', the encryption settings must assign permissions exclusively to that group and prevent users from changing those permissions. Assigning Viewer role limits access to read-only for Legal, and disabling user assignment ensures the label's protection cannot be overridden. This meets the regulatory requirement for encryption and access control.

Answer

Assign permissions to the 'Legal' group with 'Viewer' role and set 'Do not forward' for the content.

Answer

Assign permissions to the 'Legal' group with 'Viewer' role and enable 'Let users assign permissions'.

Answer

Assign permissions to the 'Legal' group with 'Co-Author' role and set an expiration date for the content.

Question 2

You are a security administrator for a company that uses Microsoft Defender XDR. A security incident involving a compromised user account has been escalated. You need to identify all devices where the compromised user account signed in within the last 7 days. Which Microsoft Defender XDR feature should you use?

Accepted Answer

Advanced hunting with the IdentityLogonEvents table. Advanced hunting with the IdentityLogonEvents table provides a comprehensive view of sign-in events across devices, including those from Defender for Identity. By querying this table for the compromised user and a 7-day timeframe, you can accurately list all devices where the account signed in, enabling effective incident response.

Answer

Incident queue filtered by the user's email address

Answer

Device inventory filtered by the user's primary email

Answer

Microsoft Defender for Cloud Apps activity log

Question 3

You have a Microsoft 365 E5 tenant with Microsoft Defender for Cloud Apps. You need to discover unsanctioned cloud apps used by users. What should you configure?

Accepted Answer

Microsoft Defender for Cloud Apps Cloud Discovery. Microsoft Defender for Cloud Apps Cloud Discovery is the correct feature for identifying unsanctioned cloud apps used in your environment. It analyzes traffic logs from your network or endpoints to discover all cloud app usage, categorizes them by risk, and allows you to sanction or unsanction them. This directly fulfills the requirement to discover unsanctioned cloud apps.

Answer

Conditional Access App Control

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Endpoint App Control

Question 4

Your organization uses Microsoft 365 E5 with Microsoft Entra ID P2. You have a hybrid identity environment with Microsoft Entra Connect Sync. You need to ensure that when a user is disabled in on-premises Active Directory, their Microsoft 365 access is blocked within 5 minutes, and any active refresh tokens are invalidated. You have already configured password hash synchronization. What should you do?

Accepted Answer

Configure Microsoft Entra Connect Sync to synchronize the 'accountEnabled' attribute and enable Continuous Access Evaluation (CAE) in Microsoft Entra ID.. Synchronizing the accountEnabled attribute from on-premises Active Directory ensures that disabled accounts are reflected in Microsoft Entra ID. Enabling Continuous Access Evaluation (CAE) allows Microsoft 365 services to respond to critical events like account disablement in near real-time, invalidating refresh tokens within minutes. Together, they meet the 5-minute blocking requirement.

Answer

Enable Microsoft Entra Password Protection and configure a custom banned password list.

Answer

Enable 'Enable password hash synchronization' and set the 'User must change password at next logon' flag in on-premises Active Directory.

Answer

Configure Microsoft Entra Connect Sync to synchronize the 'accountEnabled' attribute and enable 'Enable soft match' on the connector.

Question 5

You are a security administrator. You need to ensure that email messages containing malicious attachments are automatically removed from all mailboxes in your organization after delivery. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Zero-hour auto purge (ZAP). Zero-hour auto purge (ZAP) is the Defender for Office 365 feature that retroactively removes malicious messages from Exchange Online mailboxes after delivery. It works with Safe Attachments and Safe Links to detect threats post-delivery and automatically purge them, which is exactly what the administrator needs.

Answer

Safe Links

Answer

Anti-phishing

Answer

Safe Attachments

Question 6

An administrator has added a custom domain 'contoso.com' to their Microsoft 365 tenant and verified ownership. However, users are unable to receive emails sent to their custom domain. Which type of DNS record must the administrator add in the public DNS zone to route emails to Exchange Online?

Accepted Answer

MX record. The MX (Mail Exchange) record is the DNS record type that directs email messages to a specific mail server. For Exchange Online, the MX record must point to the tenant's mail exchanger (e.g., contoso-com.mail.protection.outlook.com) with a priority value (typically 0). Without this record, sending mail servers cannot route inbound emails to the custom domain's mailbox store in Exchange Online.

Answer

TXT record

Answer

CNAME record

Answer

SPF record

Question 7

A company wants to receive alerts when a user account is used from an unauthorized location. They have Microsoft Defender for Cloud Apps (MDA). Which policy type should they create?

Accepted Answer

Create an anomaly detection policy.. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral baselines to flag activities that deviate from a user's normal pattern — including logins from unfamiliar or unauthorized geographic locations. This is the correct policy type because the requirement is to detect unusual user behavior (impossible travel, atypical location) rather than to control sessions, permissions, or files. MDA's anomaly detection engine automatically surfaces alerts such as 'Activity from infrequent country' or 'Impossible travel' without needing a predefined rule.

Answer

Create a session policy.

Answer

Create an app permissions policy.

Answer

Create a file policy.

Question 8

A security analyst needs to create a custom detection rule in Microsoft Defender XDR that triggers when a device communicates with a new, unclassified IP address flagged by Microsoft threat intelligence as potentially malicious. The rule must run every hour and create an incident if the count of such communications exceeds 10 in a 24-hour window. Which type of rule should the analyst create?

Accepted Answer

custom detection rule using advanced hunting. A custom detection rule using advanced hunting is the correct choice because Microsoft Defender XDR allows you to create custom detection rules based on Kusto Query Language (KQL) queries that run on a scheduled interval (e.g., every hour). This rule can query the `DeviceNetworkEvents` table to identify communications with IP addresses flagged as malicious by Microsoft threat intelligence, aggregate the count over a 24-hour sliding window, and trigger an incident when the threshold of 10 is exceeded. This directly meets the requirement for a scheduled, threshold-based detection within Defender XDR.

Answer

scheduled alert rule in Microsoft Sentinel

Answer

An incident creation rule in Microsoft Defender for Cloud Apps

Answer

custom remediation action rule

Question 9

A company uses Microsoft Defender for Cloud Apps to monitor cloud app usage. They want to receive alerts when a user downloads a large number of files from SharePoint Online in a short time, which could indicate data exfiltration. What should they configure?

Accepted Answer

Activity policy. (Activity policy) is correct because activity policies allow you to monitor specific activities like mass download from SharePoint Online and trigger alerts. Option A (Session policy) is used to control access in real-time, not for alerting on historical activity. Option B (Anomaly detection policy) detects unusual user behavior but is less specific to a defined threshold of file downloads. Option C (File policy) focuses on file sharing and external sharing policies, not download volume. Therefore, an activity policy is the best choice for configuring alerts on large file downloads indicating data exfiltration.

Answer

Session policy

Answer

Anomaly detection policy

Answer

File policy

Question 10

A security administrator needs to implement a just-in-time (JIT) privileged access solution for the Global Administrator role. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should be configured?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.

Answer

Conditional Access

Answer

Azure AD Roles (default role settings)

Answer

Identity Protection